Verification of Jira Email Notification Authenticity

[didier_blanchet]

Dear Atlassian Support,

We have recently noticed a change in the appearance of Jira email notifications received by our users.

We would appreciate confirmation that the design and visual elements shown in the attached screenshot are legitimate and have not been altered by a third party.

Thank you for your assistance.

Kind regards,

[Marc -Devoteam-]

HI @didier_blanchet 

What changes, can you provide examples?

Here in community, most of us are Atlassian users like yourself, not (necessarily) employees of Atlassian. We don't have access to your environment.

This community is an open public forum.

Atlassian Support can be reached via https://support.atlassian.com/contact/

[Mihai_LeanZero]

A screenshot can't answer this. Visual design is the easiest part of an email to copy, so a convincing layout is exactly what a good forgery has.

Headers can though. Open the raw source of one notification and find the Authentication-Results line. Look for spf=pass or dkim=pass, and check which domain actually signed it in the d= tag. Atlassian has required its own outbound mail to pass SPF or DKIM since June 2022, so a real notification carries that. A forgery usually falls over right there.

Watch for Custom Domain Email Notifications though. With that switched on the DKIM signature is the company's own domain rather than Atlassian's, which reads as wrong until you know why.

The layout does get redesigned now and then. That part is probably genuine. Not the thing to judge it on.